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Abstract: Within the current multilateral security framework, Romania actively 
contributes together with other EU Member States to support international 
endeavours that have generated the development of missions and operations for 
peacekeeping, peace enforcement, rule of law, police assisting/reforming and 
reconstruction. The personnel of the national defence system takes part in a wide 
range of international missions, bringing a strong contribution to the fulfilment of the 
strategic objectives commissioned by aforementioned organizations. 

This paper represents a synthesis of several interviews conducted with different 
National Experts and provides some significant insights related to the protection of 
EU Classified Information during deploying CSDP (Common Security and Defence 
Policy) missions and operations by the European Union. The research underlines 
some possible risks, threats and vulnerabilities related to the EU Classified 
Information, and moreover to the EU security, that are generated by internal and 


external facts. 
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1 Introduction 
The main objective of the present paper is to inform the EU citizens, and especially 


the national experts that are or are to be deployed to CSDP missions and operations by 
European Union Member States (EU MS), about various possible risks, threats and 
vulnerabilities regarding the EU Classified Information (EUCI), and moreover to the EU 
security, in order to be able to undertake effective measures to protect them. 

EUCI means any information or materials designated by an EU security classification 
(starting with RESTREINT UE/EU RESTRICTED level to the TRES SECRET UE/EU TOP 
SECRET one), the unauthorized disclosure of which could generate varying degrees of 
prejudice to the interests of the European Union or of one or more of the EU MS, i.e. from 
disadvantages to exceptionally grave prejudices (Council of the EU, 2013). 

The protection of EUCI is very important not only at the EU level, but also for the 
Romanian authorities that pay a special attention to it along with the protection of national 
classified information, according to several categories of legal acts [2] that regulate very well 
the unitary implementation and control of necessary security measures regarding classified 
information and equivalent at the national and international level. 

In line with the „Agreement between the Member States of the European Union 
regarding the Protection of Classified Information Exchanged in the Interests of the 
European Union”, the EU MS share the common desire to institute a comprehensive and 
coherent general framework for the protection of classified information issued by members, 
institutions, agencies, organisms, offices or third-parties in the interests of the Union. The 
same document mentions that EU MS are aware that access to and the exchange of EUCI 
require adequate security measures for a better protection (Council of the EU, 2011). 

Within the current multilateral security framework, along with other EU MS, Romania 
actively supports the international endeavours of the Union by seconding its national experts 
to a wide range of CSDP missions and operations for crisis management, peace keeping, 
police assisting/reforming and civil society reconstruction, bringing a strong contribution to 
the fulfilment of the strategic objectives commissioned by the aforementioned organizations 
(Romanian Parliament, 2012). 

In this context, several experienced national experts belonging to law enforcement 
agencies have provided a number of significant insights related to the protection of EUCI 
during deploying CSDP missions and operations by the European Union. The synthesis of 
their answers to the questionnaire is presented subsequently. 


2 European Union’s role in ensuring international peace and security 
European Security Strategy (ESS), adopted by the European Council in 2003, offers 
the conceptual framework for European Security and Defence Policy (ESDP), which later will 
become CSDP. 
ESS defines for the first time the security situation of EU, identifying the main 
security challenges it faces as well as the subsequent political implications. Some of the main 
chapters addressed by the document underline the importance of conflict escalation 
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management, political implications of the new international context and the need for strategy 
coordination, both inside and outside the EU. 

ESS identified five key-threats: terrorism, weapons of mass destruction proliferation, 
regional conflicts, state instability and organized crime (Council of the EU, 2003) 

Upon approval of ESS, a series of monitoring and supporting missions and operations 
have been authorized in aid of EU Special Representatives (through contributions of EU MS, 
consisting in experts in the fields of human rights, security sector reform, democracy, political 
consulting, mediation, border control, disarmament, reintegration, mass-media policies). 

Currently, European CSDP missions and running operations have the duty to 
consolidate the capacity development in the following areas: police, strengthening the rule of 
law, civilian administration and civil protection (Council of the EU, 2009). 

For accomplishing the increasing number of tasks, European human resources with 
specific experience and background, suitable for the positions needed to be filled in CSDP 
missions and running operations, have been selected. 

Moreover, to better understand and develop the CSDP system, but also to bolster the 
overall legitimacy of the EU’s international security role, European Union has also invited 
non-member countries of the Euro — Atlantic community. The legal and political basis for 
contributing third states involvement in CSDP missions and operations has been possible 
under an EU invitation, provided that bilateral treaties have been concluded (i.e. Framework 
Participation Agreements). 

The above mentioned agreements follow the mandatory conditions and legal rules 
imposed by the current EU legislation under which participation should take place, while 
establishing the CSDP mission guidelines, including rules regarding classified information 
management and protection. 

Approximately forty-five non-EU States have participated in CSDP operations since 
the first mission (about thirty, if the countries that have joined the EU since 2004 are 
subtracted). So far, this kind of partnership remains limited in scope and has thus been given 
little visibility. Furthermore, whilst the contributions of partner countries may provide 
targeted responses to EU shortages, they can also be difficult for a variety of reasons (Tardy, 
2014). 

The case of contributing third states is important to be studied because, in some cases, 
their presence in CSDP missions and operations could be related to rise and junction of 
different national interests. 

Other significant element that has to be taken into account in our study is the presence 
in conflict areas of lots of interests belonging to local or transnational criminal groups 
involved in different illegal activities (e.g. terrorism, organized crime, money laundering, 
corruption, weapons, drugs and people smuggling, illegal migration etc.) struggling to survive 
the EU law enforcement and security consolidation measures on the respective states 
territories. 

Under such circumstances, a question must be asked: In order to protect EUCI and to 
achieve its goals in the best possible way, how is European Union going to combine the fully 
functioning of CSDP missions and operations, cooperation with third partner states, a junction 
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of multiple national interests and several local or transnational criminal groups fighting 
against EU's promotion of the Rule of Law? 

Considering this bundle of factors, CSDP missions and operations should permanently 
pay maximum attention to a very important and difficult task: the protection of EUCI. 


3 Risks, threats and vulnerabilities related to EUCI within CSDP missions 
and operations 

The existence of several possible risks, threats and vulnerabilities related to EUCI 
could affect both homeland and European security, which is why a careful analysis should be 
undergone for providing the necessary protection. 

An important number of Romanian and foreign national experts have participated as 
seconded or contracted personnel to CSDP missions, circumstances in which they have 
highlighted certain improvements that could aid the protection of EUCI. 

Thus, several important factors have been identified during accomplishing 
international missions which can be perceived as risks, threats and vulnerabilities related to 
the security of EUCI, regardless of their subjective or objective nature. These aspects can lead 
to a certain lack of effectiveness of the respective mission tasks and will be briefly presented 
[8]: 

- Cases when international personnel have not respected the confidentiality or secrecy 
of EUCI they had accessed, be it on account of not knowing the applicable legislation, 
or because of negligence in dealing with such matters; 

- Several EU institutions lack capabilities for conducting investigations and granting 
security clearance for local staff, enabling hiring of people that have not been fully 
assessed from a security point of view, or who may present doubts regarding their 
moral integrity; 

- Actions undertaken by criminal, terrorist, extremist or nationalist organizations, secret 
services, meant to attract local/international personnel to collaboration, or to infiltrate 
certain individuals inside the CSDP mission sectors tasked with special 
responsibilities; 

- The appointment of local personnel in the position of secretary/assistant to 
international high-ranking employees of CSDP missions. The aforementioned 
individuals could be able to access classified information without authorization and 
disseminate it illegally to people connected to local criminal groups; 

- Unauthorized access of local personnel to classified databases and their coming into 
possession of sensitive details regarding CSDP mission employees and operations; 

- The appointment of local staff in positions dealing with human resources and enabling 
them to know the identity of EU citizens involved in sensitive operations or projects 
(e.g. witness-protection programmes, special investigation task forces etc.); 

- The granting of personal favours through hiring local staff who does not meet the 
necessary job requirements; 
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The hiring of local personnel in other sensitive positions or departments, where there 
is a high probability of unauthorized access to EUCI (security, organized crime, 
investigation, justice, translation, IT engineering); 

The creation of favourable circumstances for the initiation and further development of 
intimate relationships between international staff and locals, the latter being in 
connection with organized crime groups; 

The involvement of local personnel or corrupted individuals in the supervision of 
development programs and projects through which EU funds are being administered; 
The participation in CSDP missions of the contributing third states who strive for the 
resolution of national interests in a regional context, whose representatives might not 
respect the prerequisites of bilateral treaties signed with EU or use the classified 
information to which they have access for other national purposes than those 
established by the issuing body; 

The unreasonable fear of high-ranking officials (EU citizens) not to discriminate a 
local member of staff (non-EU citizen), having as a result the illegal dissemination of 
EUCI to which the latter, normally, would not have access; 

The persuasion techniques used by a local employee when talking to an international 
member of staff could also have as a result the illegal dissemination of EUCI; 

The lack of necessary IT skills shown by those who use the organization's electronic 
equipment leads to vulnerabilities regarding cyber-espionage; 

The level of classification does not correspond to the sensitivity of the document's 
content, either being over-classified or under-classified, or the declassification has 
been done without the consent of the issuing body; 

Non-compliance with the „need to know” and „need to share” principles. 

It is certain that the unauthorized dissemination of EUCI can have severe 


consequences to EU security, to its institutions, citizens and objectives. 


on the: 


As we can see, the abovementioned factors could have a negative impact, particularly 


- Protection of EUCI used by international missions and organizations; 

- Efficiency, mandate and objectives of the CSDP missions and operations; 

- Security, democracy and stability of the host country, region and at the 
international level; 

- Physical protection of the international staff; 

- Personal data protection; 

- EU budget; 

- Funds allocated by EU MS / donors; 

- Final objectives of the EU development programmes being carried out in the host 
countries. 

In order to better understand the current situation existing in conflict areas where 


CSDP missions are deployed, as well as the difficulties encountered by EU regarding the 


achievement of specific tasks by dealing with classified information, it is paramount to 
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present certain aspects through which the gravity of the abovementioned risks, threats and 
vulnerabilities could be properly assessed by the reader. 

Although EU has made serious progress towards a coherent external policy and an 
efficient crisis management mechanism, after almost 12 years since the adoption of the ESS it 
can be noted that the continuous changes of global security require a more active and effective 
tackle of strategic objectives. There is a need for more active policies against emerging 
threats, in order to develop a strategic view capable of ensuring a strong and fast intervention, 
when needed. 

Europe is a main target for organized crime, whose activities often associate with 
terrorism and use to create a partnership for mutual benefit. In some countries outside EU, 
illegal activity groups can influence political decisions to such levels that they control most of 
the political spectrum, making difficult to build secure areas behind all EU areas, or to 
investigate criminal activities to their sources. 

Regional conflicts use to have a direct impact on European interests, threatening civil 
fundamental rights and liberties, minorities and increasing the possibility of extremist 
behaviours and state instability. Civil conflicts, poor governing, corruption, power abuse, 
weak institutions and lack of responsibility degrade the state from the inside-out, blocking the 
rule of law and democracy. 

In most of the conflict areas in which the EU missions are present at the moment, 
terrorist/criminal groups are aware of the countermeasures enforced against them, reason for 
which they are constantly trying to adapt and identify new ways to continue their illegal 
activities. Criminals pose a significant danger to the EU security because of their continuous 
improvement of skills and specializations, their access to the latest technologies, the use of 
military based tactics and their need to expand internationally, in order to increase their 
income. 

At the moment, the EU faces a new challenge, consisting of EU citizens and non- 
citizens rushing towards the conflict areas around the globe, where they are acting as 
mercenaries/volunteer fighters. The greatest fear is that these individuals will eventually 
return to their origin countries, posing a real threat to civil society, given the fact that they 
could have easily been radicalized and become a terrorist threat. Some measures have already 
been taken for managing such situations and limiting their overall effects. 

An analysis of the last years can reveal a steady increase in events connected to 
terrorism, extremism, nationalism, illegal weapons proliferation and rising interests in 
extremely dangerous technologies and materials, such as CBRN-E (Chemical, Biological, 
Radiological, Nuclear and Explosives). 


4 Critical opinions towards the actual possibility of reforming the present EU 
Classified Information system 

The present study has limited capacity of analysis, as the EU is present world-wide, 
not only through CSDP missions - managed by the European External Action Service - but 
also through EU Delegations, Offices, Special Representatives, European Council Offices, 
OSCE, observation missions, agencies and legal bodies, all of which are obliged to respect 
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and enforce the security provisions adopted by the EU Council regarding the protection of 
EUCI. 

The areas in which EUCI are being used are complex and varied, requiring constant 
efforts on behalf of EU MS, agencies and institutions to protect the data contained, as well as 
a permanent adaptation to existing security trends. 

The current EUCI standards system seems to be well established in terms of legal and 
functioning characteristics. However, as it can be seen, reducing existing risks, threats ant 
vulnerabilities should continue to be a permanent goal of the responsible institutions. 

ESS requirements can be met through the integrated management of risks, threats and 
vulnerabilities, while establishing a set of actions and directions to be followed for an 
effective prevention of potential damages. 

These measures should aim at answering and correcting the issues raised by 
international organizations’ representatives who also reported the existence of several 
controversial situations. One of them is the following: within CSDP missions and running 
operations there is an important number of local staff who, despite the fact that are not 
granted access to EUCI, they may still have illegally access to such information only by 
holding some key positions or working along with international personnel authorized to 
EUCI. 

Connected to this issue, some of the national experts have raised the following, maybe 
paradoxical, question: why do the national experts/international policemen working for CSDP 
missions have to be granted access to classified information (otherwise being impossible to 
get the job) and, on the other hand, for the local staff having sensitive jobs is not organized 
any security clearance process? 

Provided that access to EUCI is an important means by which criminal organizations 
can easily direct their businesses to effectively gain profits, it is wise to say that increasing 
security throughout all European missions, operations, institutions, agencies, offices and EU 
MS, is a necessity. 


5 Conclusions 

Taking into consideration the shifting global security threats, the EU should aim at 
creating the necessary legal and operational prerequisites for a longer dispatch of experts. 

Thus, beside the general human and material resources concerns that will arise with 
any such operation, the EU will have to take measures for increasing the effectiveness of its 
actions, while managing the security issues arisen from dealing with classified information. 

Upon closer inspection of security risk management for EUCI, known risks, threats 
and vulnerabilities should be analysed more attentively in order to define the appropriate 
measures required for limiting the effects of potential security breaches, following the 
guidelines prescribed by law, but adapted to the specific situation. 

Finally, is necessary to be mentioned that, a possible and effective method to limit the 
unauthorized access to EUCI could be the establishing within CSDP missions and operations 
of departments responsible for conducting necessary investigations and granting security 
clearance for local staff, at least for those individuals who use to come into direct contact with 
such sensitive data. 
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